SC-900 Practice Exam 57 — 20 Questions

Question 1

Your organization uses Microsoft Purview for data governance. You need to ensure that when a user marks an email as 'Confidential' using a sensitivity label, the email is automatically encrypted and cannot be forwarded. What configuration is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the sensitivity label with encryption and a rights management template that prohibits forwarding. Microsoft Purview sensitivity labels can be configured with encryption settings that use Azure Rights Management (Azure RMS) to enforce usage restrictions. By selecting the 'Do Not Forward' template, the email is automatically encrypted and the recipient cannot forward, copy, or print the message, meeting the requirement.

Answer

Create a DLP policy that detects the 'Confidential' label and applies encryption

Answer

Use the Azure Information Protection unified labeling scanner

Answer

Apply a retention label that triggers encryption

Question 2

Your organization needs to ensure that emails containing personally identifiable information (PII) like passport numbers are automatically encrypted before being sent externally. What should you configure in Microsoft Purview?

Accepted Answer

A DLP policy with the 'Encrypt' action. Data Loss Prevention (DLP) policies in Microsoft Purview can automatically detect emails containing sensitive information types (e.g., passport numbers) and apply the 'Encrypt' action to enforce encryption before the email is sent externally. This leverages Microsoft 365 Message Encryption (OME) to protect the data in transit.

Answer

A retention label that encrypts the email

Answer

A communication compliance policy

Answer

An information barrier policy

Question 3

A company has a SharePoint Online library containing legal contracts. They must satisfy a regulatory requirement that contracts cannot be modified or deleted after they are signed. Additionally, they need to retain the contracts for 10 years after the contract end date, after which they can be disposed of manually. Which Microsoft Purview solution should they implement?

Accepted Answer

Records Management. Records Management in Microsoft Purview allows you to declare items as records, which locks them against modification or deletion (meeting the 'cannot be modified or deleted' requirement). It also supports event-based retention, enabling you to start a 10-year retention period from the contract end date and then allow manual disposal after that period expires.

Answer

Sensitivity labels

Answer

Data Loss Prevention (DLP) policy

Answer

Data Lifecycle Management

Question 4

You are investigating a potential data leak. You need to find all emails that contain the word 'confidential' sent to external recipients in the last 30 days. Which Microsoft Purview tool should you use?

Accepted Answer

Content Search. Content Search (option C) is the correct tool because it allows you to perform targeted eDiscovery searches across Exchange Online mailboxes, including searching for specific keywords like 'confidential' and filtering by date range and recipient type (external recipients). It provides the exact capability to locate all emails containing the word 'confidential' sent to external recipients in the last 30 days, making it the appropriate choice for investigating a potential data leak.

Answer

Communication Compliance

Answer

Audit Log Search

Answer

Data loss prevention (DLP) policy

Question 5

Your company uses Microsoft Purview Information Protection to classify and protect sensitive data. You need to ensure that when a user sends an email containing a credit card number, the email is automatically encrypted and a custom footer is added. Which two components should you configure?

Accepted Answer

Sensitivity label with auto-classification for credit card numbers. Sensitivity labels with auto-classification for credit card numbers (Option B) allow automatic detection and classification of sensitive data types like credit card numbers. An auto-labeling policy (Option C) then applies the sensitivity label to emails, which can enforce encryption and add a custom footer. Together, these components ensure that emails containing credit card numbers are automatically encrypted and footers are added.

Answer

Data Loss Prevention (DLP) policy for credit card numbers

Answer

Retention label and policy for credit card data

Question 6

Which THREE of the following are components of the Zero Trust security model?

Accepted Answer

Use least privilege access. The three core principles of Zero Trust are: verify explicitly, use least privilege access, and assume breach. Network perimeter security is a traditional model, not Zero Trust. Single sign-on is a convenience feature, not a core principle.

Answer

Single sign-on (SSO)

Answer

Network perimeter security

Question 7

A security administrator receives an alert about a suspicious sign-in from an unfamiliar location. The user verified the sign-in as legitimate. Which Microsoft Entra ID feature should be used to reduce false positives for this user?

Accepted Answer

Identity Protection confirm user safe. Microsoft Entra ID Identity Protection's 'Confirm user safe' feature allows administrators to manually override a risk detection when a user confirms a suspicious sign-in was legitimate. This reduces false positives by telling Identity Protection to ignore that specific risk event for that user, preventing future alerts based on the same detection.

Answer

Passwordless authentication

Answer

Privileged Identity Management

Answer

Conditional Access policies

Question 8

Order the steps to create a conditional access policy in Azure AD.

Accepted Answer

Sign in, navigate to Conditional Access, create new policy, configure assignments and controls, enable policy and create.. Creating a conditional access policy requires admin sign-in, navigating to Conditional Access, creating a new policy, configuring assignments and controls, then enabling it.

Answer

Sign in, navigate to Conditional Access, create new policy, enable policy, then configure assignments and controls.

Answer

Navigate to Conditional Access, sign in, create new policy, configure assignments and controls, enable policy.

Answer

Sign in, create new policy, navigate to Conditional Access, configure assignments and controls, enable policy.

Question 9

Which THREE of the following are capabilities of Microsoft Purview Information Protection?

Accepted Answer

Auto-labeling for sensitive data. A, C, D are correct. Sensitivity labels, auto-labeling, and encryption are key capabilities of Microsoft Purview Information Protection. B (Communication monitoring) is a Communication Compliance capability. E (Retention policies) is Data Lifecycle Management.

Answer

Communication monitoring

Answer

Retention policies

Question 10

Your organization uses Microsoft Purview for data governance. You need to ensure that when a user marks an email as 'Confidential' using a sensitivity label, the email is automatically encrypted and cannot be forwarded. What configuration is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Register the storage account in Microsoft Purview Data Map and configure scanning. Microsoft Purview Data Map scans Azure Blob Storage and can auto-classify files based on built-in or custom classifiers. Option B is wrong because creating a sensitivity label and publishing it does not automatically classify the storage account; you need to register and scan it. Option C is wrong because DLP policies do not classify storage accounts directly. Option D is wrong because 'enabling Microsoft Purview Information Protection for Azure' is not a required configuration step for automatic classification of a specific storage account; automatic classification relies on registering the storage account in Microsoft Purview Data Map and configuring a scan, then applying auto-labeling policies.

Answer

Create a sensitivity label and publish it to all users

Answer

Apply a DLP policy to the storage account

Answer

Enable Microsoft Purview Information Protection for Azure

Question 11

Order the steps to respond to a data breach using Microsoft 365 Defender incident response.

Accepted Answer

Identify the breach, then Isolate affected systems, then Investigate the scope and impact, then Contain the threat, then Remediate. Incident response typically starts with identification, isolation, investigation, containment, then remediation.

Answer

Identify the breach, then Investigate the scope and impact, then Contain the threat, then Isolate affected systems, then Remediate

Answer

Contain the threat, then Identify the breach, then Investigate the scope and impact, then Isolate affected systems, then Remediate

Answer

Identify the breach, then Isolate affected systems, then Remediate, then Investigate the scope and impact, then Contain the threat

Question 12

A company wants to automatically classify sensitive documents in Microsoft 365 based on credit card numbers and retain them for 7 years. Which two Microsoft Purview solutions should they use together?

Accepted Answer

Sensitivity labels and retention policies. Sensitivity labels classify and protect content, and retention policies ensure data is kept for the required period. Data Loss Prevention (DLP) prevents sharing but does not retain; eDiscovery is for search and export; insider risk management detects risky activities. Therefore, sensitivity labels and retention policies are the correct combination.

Answer

Microsoft Purview compliance portal and Microsoft 365 Defender

Answer

Insider risk management and communication compliance

Answer

Data Loss Prevention (DLP) and eDiscovery

Question 13

Arrange the steps to investigate a user compromise using Azure AD Identity Protection.

Accepted Answer

Access the Azure AD Identity Protection portal, then review the risky users report, then select a specific user, then analyze the risk events for that user, then take remediation action.. Identity Protection investigation involves accessing the portal, reviewing risks, selecting a user, analyzing events, and taking action.

Answer

Access the Azure AD Identity Protection portal, then select a specific user, then analyze the risk events for that user, then review the risky users report, then take remediation action.

Answer

Access the Azure AD Identity Protection portal, then review the risky users report, then take remediation action, then select a specific user, then analyze the risk events.

Answer

Access the Azure AD Identity Protection portal, then analyze the risk events, then review the risky users report, then select a specific user, then take remediation action.

Question 14

A user is locked out of their account after multiple failed sign-in attempts. You need to reduce false lockouts while maintaining security. What should you do?

Accepted Answer

Enable Smart Lockout. Smart lockout learns user behavior and reduces false lockouts. Option A is wrong because requiring MFA does not prevent account lockouts; it adds another authentication factor but does not affect the lockout policy. Option B is wrong because disabling account lockout reduces security. Option D is wrong because increasing the lockout threshold may increase risk by allowing more brute-force attempts.

Answer

Require MFA for all users

Answer

Disable account lockout

Answer

Increase lockout threshold to 20 attempts

Question 15

A company wants to allow employees to access corporate resources such as email and internal apps using their personal smartphones. The IT team does not want to fully manage or domain-join these devices but needs each device to have a simple identity that links the user's work account to the device. Which Microsoft Entra ID device identity option should they implement?

Accepted Answer

Microsoft Entra ID Registered. Microsoft Entra ID supports three device identity options: Registered, Joined, and Hybrid Joined. Microsoft Entra ID Registered is designed for 'bring your own device' (BYOD) scenarios. A registered device is known to Azure AD but not fully managed; it simply links the user's work account to the device, often enabling single sign-on and conditional access. Microsoft Entra ID Joined is for corporate-owned devices that are managed by MDM. Hybrid Joined requires an on-premises Active Directory. Active Directory Joined is a traditional on-premises domain join, not a cloud identity option.

Answer

Microsoft Entra ID Joined

Answer

Hybrid Microsoft Entra ID Joined

Answer

Active Directory Joined

Question 16

Sequence the steps to configure a retention policy in Microsoft Purview compliance portal.

Accepted Answer

Sign in to Compliance Portal, navigate to Retention, create a new retention policy, select locations and conditions, set retention duration.. Retention policies require signing in, navigating to retention, creating a policy, selecting locations/conditions, and setting duration.

Answer

Navigate to Retention, sign in to Compliance Portal, create a new retention policy, select locations and conditions, set retention duration.

Answer

Sign in to Compliance Portal, navigate to Retention, select locations and conditions, create a new retention policy, set retention duration.

Answer

Sign in to Compliance Portal, create a new retention policy, navigate to Retention, select locations and conditions, set retention duration.

Question 17

Your company uses Microsoft 365 Copilot to assist employees with drafting emails and documents. The security team needs to ensure that when Copilot accesses sensitive data, it respects the organization's sensitivity labels and does not expose highly confidential information to unauthorized users. What should the security team configure?

Accepted Answer

Apply Microsoft Purview sensitivity labels to data and enable Copilot data protection. Microsoft Purview sensitivity labels are integrated with Microsoft 365 Copilot to enforce data protection. When sensitivity labels are applied to data, Copilot respects those labels and restricts access to authorized users only. Option A is incorrect because Microsoft Defender for Cloud Apps session policies govern access to cloud apps, not Copilot's handling of labeled data. Option C is incorrect because disabling Copilot for all users would prevent any use, not just sensitive data access. Option D is incorrect because data loss prevention policies block sharing of sensitive data but do not control Copilot's internal access to labeled content.

Answer

Configure Microsoft Defender for Cloud Apps session policies

Answer

Disable Copilot for all users

Answer

Create a data loss prevention policy that blocks Copilot

Question 18

Your organization has a Microsoft Purview compliance portal. You need to audit who deleted a specific file from SharePoint Online last week. What should you do?

Accepted Answer

Search the unified audit log in Microsoft Purview. The unified audit log in Microsoft Purview records all user and admin activities, including file deletions in SharePoint Online. By searching this log, you can find the specific event that shows who deleted the file, when it happened, and from which location. This is the correct tool for auditing past actions like file deletions.

Answer

Use Content Search in eDiscovery

Answer

Configure a retention policy for SharePoint

Answer

Review the data classification dashboard

Question 19

Your organization, Fabrikam Inc., uses Microsoft 365 E5 licenses. The security team is deploying Microsoft Purview to protect sensitive data. They need to ensure that when a user attempts to share a document containing credit card numbers with an external partner, the action is blocked and the user receives a policy tip. Additionally, the incident should be logged for investigation. You have already created a sensitivity label for credit card data and auto-labeled documents. Which Microsoft Purview feature should you configure to meet these requirements?

Accepted Answer

Create a Data Loss Prevention (DLP) policy that applies to documents containing credit card numbers, with an action to block sharing and notify users via policy tip.. Data Loss Prevention (DLP) policies in Microsoft Purview can detect sensitive information (e.g., credit card numbers) in documents and emails, block sharing, display policy tips, and generate incident reports. Sensitivity labels alone do not enforce restrictions on sharing. Records management handles retention. Insider risk management detects risky user activities. Audit logs record events but do not block actions.

Answer

Enable Microsoft Purview Insider Risk Management to detect the sharing activity.

Answer

Implement Microsoft Purview Records Management with a retention label that prevents sharing.

Answer

Configure a sensitivity label policy that blocks external sharing when the label is applied.

Question 20

A multinational corporation uses Microsoft Entra ID. The IT department wants to allow regional IT administrators in Europe to manage users and groups only for their own region, without granting them permissions to manage users in other regions. Which Microsoft Entra ID feature should they use?

Accepted Answer

B. Administrative Units. Administrative Units (AUs) in Microsoft Entra ID allow you to delegate administrative permissions scoped to a subset of users, groups, or devices. By creating an AU for the Europe region and assigning regional IT administrators to it, you restrict their management scope to only those objects within that AU, preventing them from managing users in other regions.

Answer

A. Conditional Access

Answer

C. Privileged Identity Management

Answer

D. Identity Governance